This activity involves deploying a remote access trojan (RAT) that shares characteristics with AsyncRAT and DCRat. The delivery mechanism for this malware relies on phishing lures themed around judicial and administrative matters. Specifically, the campaign employs lures written in both Portuguese and Spanish that mimic official documents such as court notifications, notices from the fiscalía, and tutela proceedings.
This resurgence by Blind Eagle, utilizing judicial themes in its phishing attempts across Latin America, highlights an ongoing tactical evolution in how threat actors target regional infrastructure. Market participants and institutions must remain vigilant against these sophisticated social engineering vectors.
Why it matters
This campaign demonstrates a sophisticated social engineering approach targeting regional organizations. Operators must be vigilant against seemingly legitimate judicial communications used for initial access. Monitoring for these specific lure types is crucial for platform security.
